{"id":"GHSA-763v-5pjm-fx36","kind":"vulnerability","aliases":["GHSA-763v-5pjm-fx36"],"related":[],"title":"Strands Agents: Default FileSessionManager storage is world-readable on shared systems","description":"There is a local confidentiality issue in the default `FileSessionManager` storage behavior. By default it writes session data under `/tmp/strands/sessions` and relies on the process umask for directory and file permissions. On systems using the common `umask 022`, the session directories are `0755` and JSON files are `0644`, so other local users can read persisted agent session data.\n\nThis matters on shared developer machines, CI hosts, notebooks, jump boxes, and multi-user GPU servers. Session storage is intended to persist conversation/history/state, so it can contain prompts, model output, tool inputs/outputs, intermediate state, and secrets that pass through the agent.\n\nRelevant code:\n- `strands-py/src/strands/session/file_session_manager.py:58`: default storage path is `os.path.join(tempfile.gettempdir(), \"strands/sessions\")`.\n- `strands-py/src/strands/session/file_session_manager.py:118`: creates parent directories without a private mode.\n- `strands-py/src/strands/session/file_session_manager.py:121`: writes JSON files via normal `open(..., \"w\")`.\n- `strands-py/src/strands/session/file_session_manager.py:131`: creates session directories without a private mode.\n\nLocal reproduction with `umask 022`:\n\n```text\ndefault_storage_dir= /tmp/strands/sessions\n0o755 /tmp/strands/sessions\n0o755 /tmp/strands/sessions/session_codex_perm_poc\n0o644 /tmp/strands/sessions/session_codex_perm_poc/session.json\nfile_contains_secret= True\n```\n\nThe fixture wrote a fake secret into the session dict to show that sensitive session fields are readable through the resulting file.\n\nSuggested fixes:\n- Use a private per-user data directory by default rather than `/tmp`, or create `/tmp/strands` and descendants with `0700`.\n- Write session JSON atomically with `0600` permissions.\n- Consider refusing to use an existing default storage directory if it is not owned by the current user or is group/world accessible.\n- Document that callers should set `storage_dir` explicitly when they need shared storage.\n\nThis was reproduced on commit `dd7b41de38cb`.","summary":"The Strands Agents FileSessionManager writes persisted agent sessions to /tmp/strands/sessions using the process umask, so with the common umask 022 the JSON files are world-readable. Other local users on the same machine can read prompts, model output, tool inputs and outputs, and any secrets that pass through the agent.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"strands-agents","fixed":["1.48.0"],"affected":"< 1.48.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","ci","cwe-276","notebooks","python","shared-hosts","strands-agents"],"not_affected_if":["explicit-storage-dir","restrictive-umask","single-user-host"],"how_to_check":"- Run `python -c \"import tempfile,os; print(os.path.join(tempfile.gettempdir(),'strands/sessions'))\"` and then `ls -ld /tmp/strands/sessions` to see whether the default directory exists and its mode\n- Check `ls -l /tmp/strands/sessions/*/session.json` for files with mode `-rw-r--r--`\n- Check the installed version with `pip show strands-agents` and compare against `1.48.0`","fix":"- Upgrade `strands-agents` to `1.48.0` or later\n- Set `storage_dir` on FileSessionManager to a private directory you own when using a shared host\n- Delete existing session data under `/tmp/strands/sessions` after upgrading if it may contain secrets, and rotate any secrets that appeared in sessions","status":"open","published_at":"2026-10-27T15:34:28+00:00","first_seen_at":"2026-10-27T15:39:16+00:00","triaged_at":"2026-10-27T15:39:52+00:00","updated_at":"2026-10-27T15:39:52+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T15:39:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `strands-agents` to `1.48.0` or later\n- Set `storage_dir` on FileSessionManager to a private directory you own when using a shared host\n- Delete existing session data under `/tmp/strands/sessions` after upgrading if it may contain secrets, and rotate any secrets that appeared in sessions","reach":"local","title":"Strands Agents: default session storage is readable by other local users","impact":"medium","summary":"The Strands Agents FileSessionManager writes persisted agent sessions to /tmp/strands/sessions using the process umask, so with the common umask 022 the JSON files are world-readable. Other local users on the same machine can read prompts, model output, tool inputs and outputs, and any secrets that pass through the agent.","category":"ai-tooling","nicknames":[],"who_cares":["python","strands-agents","shared-hosts","ci","notebooks"],"confidence":0.8,"needs_auth":"no","worst_case":"Other local users read persisted agent session data and secrets","analyst_note":"","how_to_check":"- Run `python -c \"import tempfile,os; print(os.path.join(tempfile.gettempdir(),'strands/sessions'))\"` and then `ls -ld /tmp/strands/sessions` to see whether the default directory exists and its mode\n- Check `ls -l /tmp/strands/sessions/*/session.json` for files with mode `-rw-r--r--`\n- Check the installed version with `pip show strands-agents` and compare against `1.48.0`","needs_analyst":false,"not_affected_if":["single-user-host","explicit-storage-dir","restrictive-umask"],"who_is_affected":"Applications using strands-agents before 1.48.0 that rely on the default FileSessionManager storage path on a multi-user machine. The exposure is local: other accounts on the same host can read the session files. Systems where only one user runs the agent, or where storage_dir is set explicitly to a private location, are not exposed by this default.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":3969,"output_tokens":715,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-276':31B '/src/strands/session/file_session_manager.py':196C,208C,220C,232C '/tmp':297C '/tmp/strands':300C '/tmp/strands/sessions':49B,110C,250C,252C '/tmp/strands/sessions/session_codex_perm_poc':254C '/tmp/strands/sessions/session_codex_perm_poc/session.json':256C '022':59B,128C,245C '0600':310C '0644':138C '0700':304C '0755':133C '0o644':255C '0o755':251C,253C '118':209C '121':221C '131':233C '58':197C '5pjm':16A,21A '763v':15A,20A 'access':333C 'agent':2A,39B,42B,46B,90B,146C,190C 'agents':25A 'ai':27B 'ai-tool':26B 'atom':308C 'behavior':102C 'box':159C 'caller':336C 'ci':29B,155C 'code':192C 'commit':351C 'common':57B,126C 'confidenti':95C 'consid':312C 'contain':176C,258C 'conversation/history/state':172C 'creat':210C,234C,299C 'current':328C 'cwe':30B 'data':108C,148C,291C 'dd7b41de38cb':352C 'default':3A,99C,104C,198C,247C,294C,318C 'descend':302C 'develop':153C 'dict':270C 'dir':249C,340C 'directori':118C,131C,212C,236C,292C,320C 'document':334C 'exist':317C 'explicit':341C 'fake':265C 'field':276C 'file':62B,120C,136C,224C,257C,282C 'filesessionmanag':4A,43B,100C 'fix':284C 'fixtur':262C 'fx36':17A,22A 'ghsa':14A,19A 'ghsa-763v-5pjm-fx36':13A,18A 'gpu':164C 'group/world':332C 'host':36B,156C 'input':80B 'inputs/outputs':181C 'intend':169C 'intermedi':182C 'issu':96C 'json':61B,135C,223C,307C 'jump':158C 'local':68B,94C,141C,241C 'machin':73B,154C 'matter':150C 'mode':216C,240C 'model':77B,178C 'multi':162C 'multi-us':161C 'need':344C 'normal':226C 'notebook':32B,157C 'open':227C 'os.path.join':202C 'output':78B,82B,179C 'own':325C 'parent':211C 'pass':87B,187C 'path':200C 'per':289C 'per-us':288C 'permiss':121C,311C 'persist':45B,145C,171C 'privat':215C,239C,287C 'process':52B,115C 'prompt':76B,177C 'py':195C,207C,219C,231C 'python':33B 'rather':295C 'read':75B,144C 'readabl':9A,66B,278C 'refus':313C 'relev':191C 'reli':112C 'reproduc':349C 'reproduct':242C 'result':281C 'secret':85B,185C,259C,266C 'sensit':274C 'server':165C 'session':47B,107C,130C,147C,166C,235C,269C,275C,306C 'set':338C 'share':11A,35B,152C,345C 'shared-host':34B 'show':272C 'state':183C 'storag':5A,101C,167C,199C,248C,319C,339C,346C 'strand':1A,38B,41B,194C,206C,218C,230C 'strands':24A 'strands-ag':37B 'strands-agents':23A 'strands-pi':193C,205C,217C,229C 'strands/sessions':204C 'suggest':283C 'system':12A,123C 'tempfile.gettempdir':203C 'text':246C 'tool':28B,79B,180C 'true':260C 'umask':53B,58B,116C,127C,244C 'use':50B,124C,285C,315C 'user':69B,142C,163C,290C,329C 'via':225C 'w':228C 'without':213C,237C 'world':8A,65B 'world-read':7A,64B 'write':44B,106C,222C,305C 'wrote':263C","nicknames":[],"mitigations":[],"who_affected":"Applications using strands-agents before 1.48.0 that rely on the default FileSessionManager storage path on a multi-user machine. The exposure is local: other accounts on the same host can read the session files. Systems where only one user runs the agent, or where storage_dir is set explicitly to a private location, are not exposed by this default.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:34:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-763v-5pjm-fx36","url":"https://github.com/advisories/GHSA-763v-5pjm-fx36","severity":"medium","published_at":"2026-10-27T15:34:28+00:00","modified_at":"2026-10-27T15:34:28+00:00","first_seen_at":"2026-10-27T15:39:16+00:00","fetched_at":"2026-10-27T15:39:16+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}